CVE-2020-24507

CWE-6653 documents3 sources

Severity

4.4MEDIUM

EPSS

0.1%

top 67.78%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Intel Converged Security AND Manageability Engine Siemens Simatic Ipc627e Firmware Siemens Simatic Ipc647e Firmware +2 more

Timeline

PublishedJun 9

Latest updateMay 24

Description

Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5intel(r)_csme_versionsversions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22

▶NVDintel/converged_security_and_manageability_engine< 12.0.81+9

▶NVDsiemens/simatic_ipc627e_firmware< 25.02.10

▶NVDsiemens/simatic_ipc647e_firmware< 25.02.10

▶NVDsiemens/simatic_ipc677e_firmware< 25.02.10

🔴Vulnerability Details

GHSA

GHSA-mxmq-w35f-5fr4: Improper initialization in a subsystem in the Intel(R) CSME versions before 11↗2022-05-24

▶

CVEList

CVE-2020-24507: Improper initialization in a subsystem in the Intel(R) CSME versions before 11↗2021-06-09

▶